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ART-UNIT: 2183 

PRIMARY-EXAMINER: Pan; Daniel H. 

ATTY-AGENT-FIRM: Wolf, Greenfield, and Sacks, P.C. 



ABSTRACT : 

A network management system includes a user interface, a virtual network and a 
device communication manager. The virtual network includes models which represent 
network entities and model relations which represent relations between network 
entities. Each model includes network data relating to a corresponding network 
entity and one or more inference handlers for processing the network data to 
provide user information. The system performs a fault isolation technique wherein 
the fault status of a network device is suppressed when it is determined that the 
device is not defective. User displays include hierarchical location views and 
topological views of the network configuration. Network devices are represented on 
the displays by multifunction icons which permit the user to select additional 
displays showing detailed information regarding different aspects of the 
corresponding network device . 

29 Claims, 13 Drawing figures 
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DOCUMENT- IDENTIFIER: US 63 742 93 Bl 

TITLE: Network management system using model -based intelligence 

Application Filing Date (1) : 
19960315 

Brief Summary Text (6) : 

Network management systems have been utilized in the past in attempts to address 
such issues. Prior art network management systems typically operated by remote 
access to and monitoring of information from network devices. The network 
management system collected large volumes of information which required evaluation 
by a network administrator. Prior art network management systems place a tremendous 
burden on the network administrator. He must be a networking expert in order to 
understand the implications of a change in a network device parameter. The 
administrator must also understand the topology of each section of the network in 
order to understand what may have caused the change. In addition, the administrator 
must sift through reams of information and false alarms in order to determine the 
cause of a problem. 

Brief Summary Text (7) : 

It is therefore desirable to provide a network management system which can 
systematize the knowledge of the networking expert such that common problems can be 
detected, isolated and repaired, either automatically or with the involvement of 
less skilled personnel. Such a system must have certain characteristics in order to 
achieve this goal. The system must have a complete and precise representation of 
the network and the networking technologies involved. It is insufficient to extend 
prior art network management systems to include connections between devices. A 
network is much more than the devices and the wires which connect them. The 
networdk involves the network devices, the network protocols and the software 
running on the devices. Without consideration of these aspects of the network, a 
model is incomplete. A system must be flexible and extendable. It must allow not 
only for the modeling of new devices, but must allow for the modeling of new 
technologies, media applications and protocol. The system must provide a facility 
for efficiently encapsulating the expert's knowledge into the system. 

Brief Summary Text (16) : 

The models are implemented as software objects containing both data relating to the 
corresponding network entity and one or more inference handlers for processing the 
data. The inference handlers are triggered by predetermined virtual network events 
such as a change in specified network data in the same model, a change in specified 
network data in a different model, predefined events or changes in models or model 
relations. Information pertaining to the condition of a network entity can be 
obtained from the network entity by polling or can be inferred from data contained 
in other models. An alarm condition is generated when the network data meets a 
predetermined criteria. Events, alarms and statistical information from the virtual 
network are stored in a database and are selectively displayed for the user. 

Detailed Description Text (2) : 

A block diagram of a network management system in accordance with the present 
invention is shown in FIG. 1. The major components of the network management system 
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are a user interface 10, a virtual network machine 12, and a device communication 
manager 14. The user interface 10, which may include a video display screen, 
keyboard, mouse and printer, provides all interaction with the user. The user 
interface controls the screen, keyboard, mouse and printer and provides the user 
with different views of the network that is being managed. The user interface 
receives network information from the virtual network machine 12 . The virtual 
network machine 12 contains a software representation of the network being managed, 
including models that represent the devices and other entities associated with the 
network, and relations between the models. The virtual network machine 12 is 
associated with a database manager 16 which manages the storage and retrieval of 
disk-based data. Such data includes configuration data, an event log, statistics, 
history and current state information. The device communication manager 14 is 
connected to a network 18 and handles communication between the virtual network 
machine 12 and network devices. The data received from the network devices is 
provided by the device communication manager to the virtual network machine 12 . The 
device communication manager 14 converts generic requests from the virtual network 
machine 12 to the required network management protocol for communicating with each 
network device. Existing network management protocols include Simple Network 
Management Protocol (SNMP) , Internet Control Message Protocol (ICMP) and many 
proprietary network management protocols. Certain types of network devices are 
designed to communicate with a network management system using one of these 
protocols . 

Detailed Description Text (14) : 

3. Attribute flags indicate how the attribute is to be manipulated. A memory flag 
indicates that the attribute is stored in memory. A database flag indicates that 
the attribute is maintained in the database of the virtual network machine. An 
external flag indicates that the attribute is maintained in the device being 
modeled. A polled flag indicates that the attributes' value should be periodically 
surveyed or polled by the device being modeled. The flags also indicate whether the 
attribute is readable or writable by the user. 

Detailed Description Text (22) : 

It will be understood that communication between a model and its corresponding 
network entity is possible only for certain types of devices such as bridges, card 
racks, hubs, etc. In other cases, the network entity being modeled is not capable 
of communicating its status to the network management system. For example, models 
of buildings or rooms containing network devices and models of cables cannot 
communicate with the corresponding network entities. In this case, the status of 
the network entity is inferred by the model from information contained in models of 
other network devices. Since successful polling of a network device connected to a 
cable may indicate that the cable is functioning properly, the status of the cable 
can be inferred from information contained in a model of the attached network 
device. Similarly, the operational status of a room can be inferred from the 
operational status contained in models of the network devices located within the 
room. In order for a model to make such inferences, it is necessary for the model 
to obtain information from related models. In a function called a model watch, an 
attribute in one model is monitored or watched by one or more other models. A 
change in the watched attribute may trigger inference handlers in the watching 
models . 

Detailed Description Text (23) : 

The virtual network machine also includes an event log, a statistics log and an 
alarm log. These logs permit information contained in the models to be organized 
and presented to the user and to be recorded in the database . 

Detailed Description Text (24) : 

The event message provides specific information about events, including alarms that 
have occurred in a given model. The events pass from the model to an event log 
manager which records the event in the external database . An event message is also 
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sent to the user interface based on event filters, as discussed below. The user can 
request event information from the database . An event message includes a model 
handle, a model -type handle, an event date and time, an event type and subtype, an 
event severity, a model name, a model -type name, an event user name, an event data 
count and event variable data. The event variable data permits additional 
information to be provided about the event . 

Detailed Description Text (26) : 

Statistics history messages are similar to the event messages described above. The 
statistics information includes any model parameters or functions which the user 
wishes to monitor. A statistics history message passes from the model to a 
statistics log manager and subsequently to the external database . The statistics 
message is also sent to the user interface based predefined filter parameters. The 
user can request the statistics log manager to obtain and display statistics 
information from the external database . Statistics messages are compiled whenever a 
device read procedure occurs . 

Detailed Description Text (29) : 

In operation, at a specified time model 144 initiates polling of network device 44 
in step 200 in order to obtain an update of the status of network device 44. The 
model 144 sends a request to the device communication manager 14 to poll network 
device 44. The device communication manager 14 converts the request to the required 
protocol for communication with network device 44 and sends the message. The 
requested information may, for example, be the number of packets sent on the 
network in a given time and the number of errors that occurred. When the requested 
information is returned to model 144, the corresponding attributes in model 144 are 
updated in step 206 and an error rate inference handler is triggered. The error 
rate inference handler in step 208 calculates the error rate for network device 44. 
If the error rate is within prescribed limits (step 210) , an error rate attribute 
is updated, and the new information is logged into the database (step 212) . If the 
calculated error rate is above a predetermined limit, an error alarm inference 
handler is triggered. The error alarm inference handler may shut off the 
corresponding network device 44 and send an alarm to the user interface in step 
214. The alarm is also logged in the database . If the network device 44 is shut off 
in response to-a high error rate, a condition attribute in model 144 is updated to 
reflect the off condition in step 216. If no response was received from the network 
device 44 when it was polled (step 218) , a fault isolation inference handler is 
triggered in step 220. The fault isolation inference handler operates as described 
below to determine the network component which caused network device 44 to fail to 
respond to the poll. When the cause of the fault is determined, a fault message is 
sent to the user interface. 

Detailed Description Text (49) : 

The virtual network machine described above including models and model relations 
provides a very general approach to network management. By customizing the virtual 
network machine, virtually any network management function can be implemented. Both 
data (attributes) and intelligence (inference handlers) are encapsulated into a 
model of a network entity. New models can be generated by combining or modifying 
existing models since the models are implemented in the C++ programming language. A 
model can be identified by a variety of different dimensions or names, depending on 
the attributes specified. For example, a particular network device can be 
identified as a device, a type of device, or by vendor or model number. Models are 
interrelated with each other by different types of relations. The relations permit 
stimulus-response chaining. The model approach provides loosely-coupled intelligent 
models with interaction between models according to specified triggers. The system 
has data location independence. The data for operation of the virtual network 
machine may reside in the database, memory or in the physical network which is 
being modeled. 

Detailed Description Text (52) : 



http://westbrs:9000/bin/gate^ 6/19/06 



Record Display Form 



Page 4 of 4 



The fault isolation technique is advantageously implemented in the conjunction with 
the model -based representation of the network and polling of network devices as 
described above. In a preferred embodiment of the fault isolation technique, each 
model that is capable of polling its corresponding network device maintains a fault 
status for that device. If contact with the device is lost, the fault status is 
set. Each such model also maintains a count of the number of network devices that 
are directly connected to the network device. In addition, each such model 
maintains a count of the number of adjacent network devices for which contact has 
been lost. This information is determined by each model watching the fault status 
in models corresponding to adjacent network devices. When a given model loses 
contact with is corresponding network device, two operations are performed. The 
fault status of the model is set, and the count of total adjacent devices is 
compared with the count of adjacent devices for which the fault status is set. If 
the counts are equal, all adjacent models have lost contact with their 
corresponding network devices. In this case, the fault status of the first model is 
suppressed. 

Detailed Description Text (64) : 

Examples of topological views are shown in FIGS. BA and 8B. In FIG. 8A, a 
topological view of a corporate site is shown. An administration network icon 330 
and an engineering network icon 332 are interconnected to an Internet icon 334 by 
links 336. Each network is represented by a multifunction icon. By clicking on the 
engineering network icon 332, a view of the details of the engineering network is 
obtained, as shown in FIG. 8B . The network devices in the engineering network are 
represented by multifunction icons 340, 342, 344, and the interconnections 346 
between network devices are shown. 

Detailed Description Text (71) : 

The user interface 10 and the virtual network machine 12 communicate via Unix 
sockets. Messages between these two components are encoded in a machine independent 
format. A user interface object such as an icon manager or a view manager may 
communicate with a model, model type or model relation in the virtual network 
machine in order to retrieve attribute data. 

Other Reference Publication (5) : 

*Gargano et al . , "A Logical Data Model On Integrated Geographical Database, 11 IEEE 
0/1990, pp. 473-481. 
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ART-UNIT: 273 

PRIMARY -EXAMINER: Follensbee; John A. 

ASSISTANT-EXAMINER: Nguyen; Dzung C 

ATTY- AGENT -FIRM: Wolf, Freenfield & Sacks, P.C. 



ABSTRACT : 

A network management system includes a user interface, a virtual network and a 
device communication manager. The virtual network includes models which represent 
network entities and model relations which represent relations between network 
entities. Each model includes network data relating to a corresponding network 
entity and one or more inference handlers for processing the network data to 
provide user information. The system can poll or communicate with certain network 
entities and can infer the status of network connectors and other network entities 
for which polling is impossible or impractical. The system performs a fault 
isolation technique wherein the fault status of a network device is suppressed when 
it is determined that the device is not defective. User displays include 
hierarchical location views and topological views of the network configuration. 
Network devices are represented on the displays by multifunction icons which permit 
the user to select additional displays showing detailed information regarding 
different aspects of the corresponding network device. 

10 Claims, 16 Drawing figures 
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Application Filing Date (1) : 
19980915 

Brief Summary Text (6) : 

Network management systems have been utilized in the past in attempts to address 
such issues. Prior art network management systems typically operated by remote 
access to and monitoring of information from network devices. The network 
management system collected large volumes of information which required evaluation 
by a network administrator. Prior art network management systems place a tremendous 
burden on the network administrator. He must be a networking expert in order to 
understand the implications of a change in a network device parameter. The 
administrator must also understand the topology of each section of the network in 
order to understand what may have caused the change. In addition, the administrator 
must sift through reams of information and false alarms in order to determine the 
cause of a problem. 

Brief Summary Text (7) : 

It is therefore desirable to provide a network management system which can 
systematize the knowledge of the networking expert such that common problems can be 
detected, isolated and repaired, either automatically or with the involvement of 
less skilled personnel. Such a system must have certain characteristics in order to 
achieve this goal. The system must have a complete and precise representation of 
the network and the networking technologies involved. It is insufficient to extend 
prior art network management systems to include connections between devices. A 
network is much more than the devices and the wires which connect them. The network 
involves the network devices, the network protocols and the software running on the 
devices. Without consideration of these aspects of the network, a model is 
incomplete. A system must be flexible and extendable. It must allow not only for 
the modeling of new devices, but must allow for the modeling of new technologies, 
media applications and protocol. The system must provide a facility for efficiently 
encapsulating the expert's knowledge into the system. 

Detailed Description Text (4) : 

The virtual network machine 12 contains a software representation of the network 
being managed, including models that represent the devices and other entities 
associated with the network, and relations between the models. The virtual network 
machine 12 is associated with a database manager 16 which manages the storage and 
retrieval of disk-based data. Such data includes configuration data, an event log, 
statistics, history and current state information. 

Detailed Description Text (5) : 

The device communication manager 14 is connected to a network 18 and handles 
communication between the virtual network machine 12 and network devices. The data 
received from the network devices is provided by the device communication manager 
to the virtual network machine 12. The device communication manager 14 converts 
generic requests from the virtual network machine 12 to the required network 
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management protocol for communicating with each network device. Existing network 
management protocols include Simple Network Management Protocol (SNMP) , Internet 
Control Message Protocol (ICMP) and many proprietary network management protocols. 
Certain types of network devices are designed to communicate with a network 
management system using one of these protocols. 

Detailed Description Text (18) : 

(3) Attribute flags indicate how the attribute is to be manipulated. A memory flag 
indicates that the attribute is stored in memory. A database flag indicates that 
the attribute is maintained in the database of the virtual network machine. An 
external flag indicates that the attribute is maintained in the device being 
modeled. A polled flag indicates that the attributes value should be periodically 
surveyed or polled by the device being modeled. The flags also indicate whether the 
attribute is readable or writable by the user. 

Detailed Description Text (26) : 

It will be understood that communication between a model and its corresponding 
network entity is possible only for certain types of devices such as bridges, card 
racks, hubs, etc. In other cases, the network entity being modeled is not capable 
of communicating its status to the network management system. For example, models 
of buildings or rooms containing network devices and models of cables cannot 
communicate with the corresponding network entities. In this case, the status of 
the network entity is inferred by the model from information contained in models of 
other network devices. Since successful polling of a network device connected to a 
cable may indicate that the cable is functioning properly, the status of the cable 
can be inferred from information contained in a model of the attached network 
device. Similarly, the operational status of a room can be inferred from the 
operational status contained in models of the network devices located within the 
room. In order for a model to make such inferences, it is necessary for the model 
to obtain information from related models. In a function called a model watch, an 
attribute in one model is monitored or watched by one or more other models. A 
change in the watched attribute may trigger inference handlers in the watching 
models . 

Detailed Description Text (27) : 

The virtual network machine also includes an event log, a statistics log and an 
alarm log. These logs permit information contained in the models to be organized 
and presented to the user and to be recorded in the database . 

Detailed Description Text (28) : 

The event message provides specific information about events, including alarms that 
have occurred in a given model. The events pass from the model to an event log 
manager which records the event in the external database . An event message is also 
sent to the user interface based on event filters, as discussed below. The user can 
request event information from the database . An event message includes a model 
handle, a model -type handle, an event date and time, an event type and subtype, an 
event severity, a model name, a model -type name, an event user name, an event data 
count and event variable data. The event variable data permits additional 
information to be provided about the event . 

Detailed Description Text (30) : 

Statistics history messages are similar to the event messages described above. The 
statistics information includes any model parameters or functions which the user 
wishes to monitor. A statistics history message passes from the model to a 
statistics log manager and subsequently to the external database . The statistics 
message is also sent to the user interface based upon predefined filter parameters. 
The user can request the statistics log manager to obtain and display statistics 
information from the external database. Statistics messages are compiled whenever a 
device read procedure occurs. 
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Detailed Description Text (33) : 

In operation, at a specified time model 144 initiates polling of network device 44 
in step 200 in order to obtain an update of the status of network device 44. The 
model 144 sends a request to the device communication manager 14 to poll network 
device 44. The device communication manager 14 converts the request to the required 
protocol for communication with network device 44 and sends the message. The 
requested information may, for example, be the number of packets sent on the 
network in a given time and the number of errors that occurred. When the requested 
information is returned to model 144, the corresponding attributes in model 144 are 
updated in step 2 06 and an error rate inference handler is triggered. The error 
rate inference handler in step 208 calculates the error rate for network device 44. 
If the error rate is within prescribed limits (step 210) , an error rate attribute 
is updated, and the new information is logged into the database (step 212) . If the 
calculated error rate is above a predetermined limit, an error alarm inference 
handler is triggered. The error alarm inference handler may shut off the 
corresponding network device 44 and send an alarm to the user interface in step 
214. The alarm is also logged in the database . If the network device 44 is shut off 
in response to a high error rate, a condition attribute in model 144 is updated to 
reflect the off condition in step 216. If no response was received from the network 
device 44 when it was polled (step 218) , a fault isolation inference handler is 
triggered in step 220. The fault isolation inference handler operates as described 
below to determine the network component which caused network device 44 to fail to 
respond to the poll. When the cause of the fault is determined, a fault message is 
sent to the user interface. 

Detailed Description Text (53) : 

The virtual network machine described above including models and model relations 
provides a very general approach to network management. By customizing the virtual 
network machine, virtually any network management function can be implemented. Both 
data (attributes) and intelligence (inference handlers) are encapsulated into a 
model of a network entity. New models can be generated by combining or modifying 
existing models since the models are implemented in the C++ programming language. A 
model can be identified by a variety of different dimensions or names, depending on 
the attributes specified. For example, a particular network device can be 
identified as a device, a type of device, or by vendor or model number. Models are 
interrelated with each other by different types of relations. The relations permit 
stimulus -response chaining. The model approach provides loosely-coupled intelligent 
models with interaction between models according to specified triggers. The system 
has data location independence. The data for operation of the virtual network 
machine may reside in the database, memory or in the physical network which is 
being modeled. 

Detailed Description Text (56) : 

The fault isolation technique is advantageously implemented in the conjunction with 
the model -based representation of the network and polling of network devices as 
described above. In a preferred embodiment of the fault isolation technique, each 
model that is capable of polling its corresponding network device maintains a fault 
status for that device. If contact with the device is lost, the fault status is 
set. Each such model also maintains a count of the number of network devices that 
are directly connected to the network device. In addition, each such model 
maintains a count of the number of adjacent network devices for which contact has 
been lost. This information is determined by each model watching the fault status 
in models corresponding to adjacent network devices. When a given model loses 
contact with its corresponding network device, two operations are performed. First, 
the fault status of the model is set. Second, the count of total adjacent devices 
is compared with the count of adjacent devices for which the fault status is set. 
If the counts are equal, all adjacent models have lost contact with their 
corresponding network devices, and the fault status of the first model is 
suppressed. 
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Detailed Description Text (68) : 

Examples of topological views are shown in FIGS. 8A and 8B. In FIG. 8A, a 
topological view of a corporate site is shown. An administration network icon 330 
and an engineering network icon 332 are interconnected to an Internet icon 334 by 
links 336. Each network is represented by a multifunction icon. By clicking on the 
engineering network icon 332, a view of the details of the engineering network is 
obtained, as shown in FIG. 8B. The network devices in the engineering network are 
represented by multifunction icons 340, 342, 344, and the interconnections 346 
between network devices are shown. 

Detailed Description Text (75) : 

The user interface 10 and the virtual network machine 12 communicate via Unix 
sockets. Messages between these two components are encoded in a machine independent 
format. A user interface object such as an icon manager or a view manager may 
communicate with a model, model type or model relation in the virtual network 
machine in order to retrieve attribute data. It is to be understood that 
alternative embodiments may utilize any of a variety of software communication 
methods and that the present invention is in no way limited to any particular 
operating system or any particular software communication protocol. 

Detailed Description Text (86) : 

The connector model classifies ports into two types. First, there are repeater 
ports. Repeater ports are extremely common entities within a network. For instance, 
a network hub may have 100 repeater ports. The connector model, however, requires 
information from only a relatively few of the repeater ports. More specifically, 
the connector model requires information from only those repeater ports that are 
connected to a connector with a corresponding inferred connector model. It is 
therefore advantageous to limit polling requests to those repeater ports that are 
connected to modeled connectors. In a preferred embodiment, the connector models 
poll only those repeater ports that are connected to a modeled connector. Second, 
there are Internet Interface ports, which are far less common than repeater ports 
in a network system. In the preferred embodiment all Internet Interface ports are 
polled, as the relative infrequency of these ports does not warrant the extra 
complexity of optimizing software. It is understood, however, that the same 
technique applied to repeater port polling optimization can easily be applied to 
Internet Interface ports. 

Detailed Description Text (87) : 

The Internet Interface port specific routines utilize names that reflect the terms 
used within the art. Specifically, admin. sub.-- status and operational . sub. - - 
status are attributes within the Management Information Base (MIB) of Internet 
Interface ports. The connector models utilize these names. Operational . sub. - - 
status represents the actual status of the port. Admin. sub.-- status represents the 
desired status of the port. It should be noted that individual ports can be turned 
off by the management system. When this is done, admin. sub.-- status is "down"; 
admin. sub.-- status or operational . sub. -- status of "up" indicates that the port is 
operative . 

Detailed Description Text (95) : 

6. An INTERFACE . sub .- - INTERNAL . sub .- - LINK. sub.-- STATUS routine determines the 
port. sub.-- link. sub.-- status for Internet Interface ports that are connected to a 
modeled connector. This routine polls operational . sub .- - status for those ports. 
When the operational . sub . -- status is "down" and the admin. sub.-- status is "up" 
after polling, this routine sets port. sub.-- link. sub.-- status to "bad"; otherwise 
port. sub.-- link. sub.-- status is set to "good". It should be noted that a port can 
be turned off by the management system. When this is done, admin. sub.-- status is 
set to "down." It follows that for connector model purposes, when the desired 
status, i.e., admin status, is down for a particular port, an operational . sub .- - 
status of down for that port should not be construed as the port being inoperative. 
For the reasons discussed above, when contact . sub . status is "lost" for the 
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ported device, port. sub.-- link. sub.-- status is set to "unknown." 
Detailed Description Text (99) : 

The formula makes the following inferences. First, if all entities connected to a 
connector are either "lost," known "bad," or "initial," the connector is inferred 
to be "lost." This inference is sound because, if the connector is "lost," this can 
account for all of the devices having their contact status as "lost" or their 
port. sub.-- link. sub.-- status as "bad." Second, if all the devices on the 
connector are still in an initial state, then the connector is best described as 
being in an initial state, i.e., it is not yet known whether the connector is 
properly connected. It should be noted that models do not remain in an "initial" 
state for very long. Contact . sub . -- status changes from "initial." after the next 
polling interval. Polling intervals ordinarily occur on the order of every minute, 
but as previously stated the polling interval is programmable. Finally, if any 
device connected to the connector is "established", then the connector must be 
established, as there is no other way in which the device could have that 
contact . sub . -- status. 

Other Reference Publication (11) : 

Gargano et al . , "A Logical Data Model On Integrated Geographical Database, " IEEE 
0/1990, pp. 473-481. 
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ABSTRACT : 

A network management system includes a user interface, a virtual network and a 
device communication manager. The virtual network includes models which represent 
network entities and model relations which represent relations between network 
entities. Each model includes network data relating to a corresponding network 
entity and one or more inference handlers for processing the network data to 
provide user information. The system can poll or communicate with certain network 
entities and can infer the status of network connectors and other network entities 
for which polling is impossible or impractical. The system performs a fault 
isolation technique wherein the fault status of a network device is suppressed when 
it is determined that the device is not defective. User displays include 
hierarchical location views and topological views of the network configuration. 
Network devices are represented on the displays by multifunction icons which permit 
the user to select additional displays showing detailed information regarding 
different aspects of the corresponding network device. 
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